

open source software getting backdoored by nefarious committers is not an indictment on closed source software in any way. this was discovered by a microsoft employee due to its effect on cpu usage and its introduction of faults in valgrind, neither of which required the source to discover.
the only thing this proves is that you should never fully trust any external dependencies.
start with basics:
iperf
on every device you can between an external device and your internal host(s) and use it to find any bottleneckstcpdump
to analyze packets flowing over the network. you can often find surprising results this wayiperf
) with the most simple config (no nginx etc) and add the complexity of your config bit by bit until the issue returns